How can I grant specific administrative privileges without granting view/modify all data?

Question

How can I restrict a user to do only the following activities?

• User maintenance - Create Users, Deactivate Users, Change Permissions, Change Role in hierarchy, Update Name, Federation Id, and other user attributes
• Add Help Text
• Create Fields, modify field attributes, remove from page layouts, modify page layouts, update pick-lists
• Create email template, update email template

The user should not have the ability to view/modify all data.

Answer 1

• To create / modify Users, grant Manage Internal Users permission
• To create fields / modify help text and page layouts, grant Customize Application permission
• To create / modify email templates, grant Edit HTML Templates and Manage Public Templates permissions
• To create / modify profile and permission set permissions, grant Manage Profiles and Permission Sets permission

Please note that granting Customize Application permission will automatically grant additional permissions, however this permission is required in order to make the types of changes you described.

See also More Specific Permissions for Managing Users for more specific User management permissions that are available.

The permissions I described above can be granted using either Profiles or Permission Sets.